EUVD-2026-67804
GHSA-q48c-g8g8-2xq8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible API requires a valid authenticated session (PR:L); scope unchanged as impact is confined to reading other users' thread data within the same system; no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and metadata of other resource owners.
AnalysisAI
Cross-user thread enumeration in the Mastra AI framework through version 1.63.0 allows authenticated low-privilege attackers to read conversation histories and metadata belonging to other resource owners via the memory API. The ownership validation in GET /api/memory/threads is silently disabled when the mapUserToResourceId callback is omitted from server configuration, creating a no-op authorization gate (CWE-862). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two conditions to be true simultaneously: (1) the attacker holds any valid authenticated session on the target Mastra instance (PR:L per the provided CVSS 4.0 vector - unauthenticated access is insufficient); and (2) the Mastra server is configured WITHOUT the `mapUserToResourceId` callback, which is the specific omission that disables thread ownership validation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) indicates low-complexity network exploitation requiring only a low-privilege authenticated session, with high confidentiality impact and no integrity or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Administrators should immediately configure the `mapUserToResourceId` callback in their Mastra server setup to enforce thread ownership scoping - omitting this callback is the direct and sufficient cause of the vulnerability, so adding it constitutes an effective compensating control without requiring a version upgrade. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Mastra AI deployments to identify instances running version 1.63.0 or earlier and verify that the mapUserToResourceId authorization callback is properly configured and enabled; document any instances where this callback is missing or disabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today